Linux Kernel AoE Driver Use‑After‑Free (CVE‑2023‑6270) Enables Local Privilege Escalation
What It Is – A use‑after‑free flaw in the ATA over Ethernet (AoE) driver of the Linux kernel permits a low‑privileged attacker to execute arbitrary code with kernel‑level privileges. The bug stems from missing object‑existence validation before dereferencing, allowing memory corruption.
Exploitability – The vulnerability is locally exploitable; an attacker must first run code with unprivileged rights. No public exploit‑as‑a‑service has been observed, but proof‑of‑concept code was released with the advisory. CVSS 7.8 (High).
Affected Products – All Linux distributions that ship the affected kernel version (the AoE driver is part of the mainline kernel). Vendors have issued patches; see Red Hat Bug 2256786 for details.
TPRM Impact –
- Any third‑party service that runs on unpatched Linux hosts is exposed to privilege‑escalation attacks that could compromise the entire host and downstream services.
- Supply‑chain risk rises because compromised hosts can be used to inject malicious code into containers, CI/CD pipelines, or hosted workloads.
Recommended Actions –
- Verify that all Linux servers are running kernel ≥
<patched‑version>(refer to vendor advisories). - Deploy the Red Hat patch (or equivalent from your distro) immediately.
- Conduct a rapid inventory of any systems still using the vulnerable AoE driver; disable AoE if not required.
- Review host‑based intrusion‑detection logs for unexpected kernel‑mode activity.
- Update your TPRM risk register to reflect a Medium‑High supply‑chain exposure until remediation is confirmed.
Source: Zero Day Initiative Advisory – ZDI‑26‑238 (CVE‑2023‑6270)